chore: add trivy to the lint stack

[iloveitaly]

Motivation

The lint stack already covers secrets in git history with gitleaks, but it does not scan dependency advisories or infrastructure misconfiguration. Trivy covers that working-tree gap.

Description

• Install Trivy with mise (aqua:aquasecurity/trivy, locked at 0.74.0) as a dev/CI tool.
• Run trivy fs --config .config/trivy.yaml . from just dev_lint, which just lint and the backend CI job already call.
• Policy lives in .config/trivy.yaml: HIGH and CRITICAL only, ignore unfixed advisories, include dev dependencies, and scan vulnerabilities, misconfigurations, and secrets. Vendored mise locks and node_modules are skipped.
• Cache ~/.cache/trivy in the backend workflow so the vulnerability database is not downloaded on every run.
• Keep the public Dokku ingress and the Terraform state storage account reachable. Those resources are intentional, so the matching Trivy checks are ignored inline.
• Pin brace-expansion, js-yaml, and shell-quote in web/pnpm-workspace.yaml so the new gate is green.

Screenshots / Test

just dev_lint exits 0. gitleaks reports no leaks, and the Trivy report shows 0 high or critical vulnerabilities, misconfigurations, and secrets for uv.lock, web/pnpm-lock.yaml, and infra/azure. Trivy logs Loaded file_path=".config/trivy.yaml".

Links

• https://trivy.dev/docs/latest/guide/references/configuration/config-file/